passbolt/passbolt_api · error · ForbiddenException

SSO settings edit endpoints are disabled.

Error message

SSO settings edit endpoints are disabled.

What it means

The SSO endpoints security middleware hard-blocks SSO settings edit endpoints when the Configure flag passbolt.security.sso.settings.endpoints.disabled (SECURITY_CONFIG_KEY) is truthy. Any request routed through the middleware is rejected with ForbiddenException regardless of authentication.

Solutions

1. Disable SSO edits via UI is intended: configure SSO using the CLI command (passbolt sso_settings) instead of HTTP endpoints
2. Remove/unset the security config flag (e.g. PASSBOLT_SECURITY_SSO_SETTINGS_ENDPOINTS_DISABLED=false) and restart, if HTTP editing is desired
3. Verify the flag value with `passbolt sso_settings dump` or inspect config/passbolt.php and environment

Example fix

// before (config/passbolt.php)
'security' => ['sso' => ['settings' => ['endpoints' => ['disabled' => true]]]],
// after
'security' => ['sso' => ['settings' => ['endpoints' => ['disabled' => false]]]],

if (Configure::read('passbolt.security.sso.settings.endpoints.disabled')) {
    // edit endpoints blocked; use CLI instead
}

try {
    $response = $api->put('/sso/settings/' . $id, $payload);
} catch (ClientException $e) {
    if ($e->getResponse()->getStatusCode() === 403) {
        // fall back to `passbolt sso_settings` CLI
    }
}

When it happens

Trigger: Any POST/PUT/DELETE to SSO settings CRUD endpoints while the disable flag is set in config (e.g. set via environment variable PASSBOLT_SECURITY_SSO_SETTINGS_ENDPOINTS_DISABLED=true or config file).

Common situations: Instance hardened for production where SSO settings must be edited via CLI/healthcheck only; operators forgot the flag is enabled when trying to configure SSO in the UI; self-hosted instances upgrading after the security option was introduced.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Directory sync settings endpoints are disabled.
• Access to this service requires an invitation. Please…
• Metadata settings endpoints are disabled.
• Secret revisions settings endpoints are disabled.
• The SSO authentication token is invalid. Token IP is…

AI-assisted analysis of passbolt/passbolt_api@31c1bbc10f (2026-09-17). Data as JSON: /api/errors/90979b9fcdbdb289. Report an issue: GitHub.

Appendix: source

Thrown at plugins/PassboltEe/Sso/src/Middleware/SsoEndpointsSecurityMiddleware.php:38

use Cake\Http\Exception\ForbiddenException;
use Psr\Http\Message\ResponseInterface;
use Psr\Http\Message\ServerRequestInterface;
use Psr\Http\Server\MiddlewareInterface;
use Psr\Http\Server\RequestHandlerInterface;

class SsoEndpointsSecurityMiddleware implements MiddlewareInterface
{
    public const SECURITY_CONFIG_KEY = 'passbolt.security.sso.settings.editionDisabled';

    /**
     * @param \Psr\Http\Message\ServerRequestInterface $request The request.
     * @param \Psr\Http\Server\RequestHandlerInterface $handler The handler.
     * @return \Psr\Http\Message\ResponseInterface The response.
     */
    public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
    {
        if (Configure::read(self::SECURITY_CONFIG_KEY)) {
            throw new ForbiddenException(__('SSO settings edit endpoints are disabled.'));
        }

        return $handler->handle($request);
    }
}

View on GitHub (pinned to 31c1bbc10f)